Pas, who you are responding to, used the more ambiguous abbreviation of "auth", but I was specifically referring to authorization, not authentication. So once you are authenticated, i.e. once I know who you are, what are you allowed to do? This is a deeper, domain-specific question, and the GraphQL guide rightly points out that this doesn't belong in whatever glue layer exists between your domain logic and the schema you expose.